Subject: Re: [Bimi] bimi Digest, Vol 11, Issue 2

From: Marcel Bokhorst <[email-masked]>
Date: Fri, 6 Aug 2021 08:09:28 +0200

Since there is no SVG support in Android (really not!), a third party
library needs to be used. FairEmail uses this one:

http://bigbadaboom.github.io/androidsvg/

Unfortunately, there is no support for strict SVG profiles in this library
and there are not many other libraries (maintained and supported) and they
will probably not support strict profiles either.

So, from the perspective of Android, SVG is a bad choice. PNG would have
been better I guess.

Op vr 6 aug. 2021 om 07:48 schreef <[email-masked]>:

> Send bimi mailing list submissions to
>         [email-masked]
>
> To subscribe or unsubscribe via the World Wide Web, visit
>         https://www.ietf.org/mailman/listinfo/bimi
> or, via email, send a message with subject or body 'help' to
>         [email-masked]
>
> You can reach the person managing the list at
>         [email-masked]
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of bimi digest..."
> Today's Topics:
>
>    1. Re: Fwd: bimi Digest, Vol 10, Issue 2 (Marc Bradshaw)
>    2. Re: Fwd: bimi Digest, Vol 10, Issue 2 (Dave Crocker)
>    3. Re: Fwd: bimi Digest, Vol 10, Issue 2 (Marcel Bokhorst)
>    4. Re: Fwd: bimi Digest, Vol 10, Issue 2 (Marc Bradshaw)
>
>
>
> ---------- Forwarded message ----------
> From: Marc Bradshaw <[email-masked]>
> To: [email-masked]
> Cc:
> Bcc:
> Date: Fri, 06 Aug 2021 11:57:25 +1000
> Subject: Re: [Bimi] Fwd: bimi Digest, Vol 10, Issue 2
>
>
> On Fri, 30 Jul 2021, at 5:57 PM, Marcel Bokhorst wrote:
>
> The logo will always be shown, but the verified sender icon (a double
> check mark before the sender's name) will be shown only when everything
> checks out.
>
>
> I'm concerned by this, are any checks being done before showing the logo?
> Part of the reason behind the strict SVG profile is to strip out anything
> which may be a security or privacy risk, and depending on the
> implementation of the svg display code this could open users up to
> malicious scripting, or privacy bugs being executed.
> This is also one belefit of allowing the server to do the heavy lifting,
> checking everything is ok, and adding a pre-verified SVG into the
> BIMI-Indicator header. If (and I recognise that this IF if the issue here)
> the MUA trusts the MTA then there are some security and privacy benefits
> there.
>
> --
>
>   Marc Bradshaw
>   marcbradshaw.net | @marcbradshaw <https://twitter.com/marcbradshaw>
>
>
>
>
>
> ---------- Forwarded message ----------
> From: Dave Crocker <[email-masked]>
> To: Marcel Bokhorst <[email-masked]>, [email-masked]
> Cc:
> Bcc:
> Date: Thu, 5 Aug 2021 19:10:59 -0700
> Subject: Re: [Bimi] Fwd: bimi Digest, Vol 10, Issue 2
> On 7/30/2021 12:57 AM, Marcel Bokhorst wrote:
> > The logo will always be shown, but the verified sender icon (a double
> > check mark before the sender's name) will be shown only when everything
> > checks out.
>
>
> Wow.
>
> What is supposed to be the differential user benefit in showing the icon?
>
> I'm asking because there is no objective evidence it will make any
> difference in to real-world user behavior.
>
> d/
>
> --
> Dave Crocker
> Brandenburg InternetWorking
> bbiw.net
>
>
>
>
>
> ---------- Forwarded message ----------
> From: Marcel Bokhorst <[email-masked]>
> To: Dave Crocker <[email-masked]>
> Cc: [email-masked]
> Bcc:
> Date: Fri, 6 Aug 2021 07:19:32 +0200 (GMT+02:00)
> Subject: Re: [Bimi] Fwd: bimi Digest, Vol 10, Issue 2
> The difference is that individuals and smaller companies can show an logo.
>
> Currently, I have seen only one company using BIMI with a valid VMC, which
> is Booking.com. The VMC of both PayPal and LinkedIn is expired.
>
> On the other hand, I have seen a number of logos of individuals and
> smaller companies and organizations without a VMC.
>
> I understand that just a logo doesn't imply verification, but it still
> makes it easier to recognize emails. Unverified sender doesn't say bad
> sender!
>
> Verified senders are clearly marked with a double check mark, you won't
> miss.
>
> Maybe this is not the intended use of the BIMI standard, but this is how
> it works in practice now.
>
> I think the implied question is "/How about individual and small
> companies?/" and "/How about adoption of big companies?/".
>
> 6 aug. 2021 04:11:08 Dave Crocker <[email-masked]>:
>
> > On 7/30/2021 12:57 AM, Marcel Bokhorst wrote:
> >> The logo will always be shown, but the verified sender icon (a double
> check mark before the sender's name) will be shown only when everything
> checks out.
> >
> >
> > Wow.
> >
> > What is supposed to be the differential user benefit in showing the icon?
> >
> > I'm asking because there is no objective evidence it will make any
> difference in to real-world user behavior.
> >
> > d/
> >
>
>
>
>
>
> ---------- Forwarded message ----------
> From: Marc Bradshaw <[email-masked]>
> To: [email-masked]
> Cc:
> Bcc:
> Date: Fri, 06 Aug 2021 15:47:42 +1000
> Subject: Re: [Bimi] Fwd: bimi Digest, Vol 10, Issue 2
>
> On Fri, 6 Aug 2021, at 3:19 PM, Marcel Bokhorst wrote:
>
> The difference is that individuals and smaller companies can show an logo.
>
> Currently, I have seen only one company using BIMI with a valid VMC, which
> is Booking.com. The VMC of both PayPal and LinkedIn is expired.
>
>
> We are seeing a number of valid VMCs in the wild, and that number is
> growing quickly now we are past the pilot stage, but yes, we also see a
> number of expired or otherwise problematic VMCs, but this group isn't the
> place to address that.
>
> On the other hand, I have seen a number of logos of individuals and
> smaller companies and organizations without a VMC.
>
> I understand that just a logo doesn't imply verification, but it still
> makes it easier to recognize emails. Unverified sender doesn't say bad
> sender!
>
> Verified senders are clearly marked with a double check mark, you won't
> miss.
>
>
> The verification of an Evidence Document (of which a VMC is currently the
> only example) is optional. It feels perfectly fine to display both self
> asserted and evidence verified logos, with some visual indication there, so
> long as it's clear what that visual indication is implying of course.
>
> There are other things which need to be verified, such as the DMARC
> enforcement status of the domain, and compliance of the SVG to the Tiny-PS
> profile. These are not optional, so please do make sure those checks are
> done before showing the logo.
>
> Maybe this is not the intended use of the BIMI standard, but this is how
> it works in practice now.
>
> I think the implied question is "/How about individual and small
> companies?/" and "/How about adoption of big companies?/".
>
>
> Don't forget, this is still an experiment, we have to start somewhere.
>
> For some context, Fastmail will do all of the technical policy and profile
> checks, and not show a logo if any of those fail. If there is a VMC present
> then we will check it, and not display for any domains which fail the VMC
> check, but if one is not present then a logo will be shown provided all of
> the previously mentioned technical and policy checks passed.
>
> 6 aug. 2021 04:11:08 Dave Crocker <[email-masked]>:
>
> > On 7/30/2021 12:57 AM, Marcel Bokhorst wrote:
> >> The logo will always be shown, but the verified sender icon (a double
> check mark before the sender's name) will be shown only when everything
> checks out.
> >
> >
> > Wow.
> >
> > What is supposed to be the differential user benefit in showing the icon?
> >
> > I'm asking because there is no objective evidence it will make any
> difference in to real-world user behavior.
> >
> > d/
> >
>
> --
> bimi mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/bimi
>
>
> --
>
>   Marc Bradshaw
>   marcbradshaw.net | @marcbradshaw <https://twitter.com/marcbradshaw>
>
>
> bimi mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/bimi
>